Field Device and Code Security Baseline
Field Device and Code Security Baseline
Adapted from GitLab's Product Security, Vulnerability Management and Secure Coding pages, for NFE's field hardware and software.
What NFE deploys at customer sites (meters, hybrid inverters, OpenEMS on Raspberry Pi, the inverter monitor) controls people's power. A compromise there is an S1.
Baseline for every field device (before it leaves for a site)
- Default passwords changed on the inverter, meter, router and Pi (e.g. OpenEMS
admin/admin, the Pi's default user). Credentials stored in the shared vault. - SSH: key-based login only; password login and root login disabled.
- No direct internet exposure: no port forwarding to the Pi, OpenEMS UI or Modbus. Remote access only through a VPN or tunnel (Tailscale/WireGuard).
- Modbus/TCP and RS-485 stay local. Modbus has no authentication or encryption; some inverters accept write commands with no password. Restrict writes to the controller that needs them.
- Updates: OS security updates enabled (
unattended-upgradeson Raspberry Pi OS). Firmware versions recorded. - Notification/alert endpoints bind to localhost or require a token. See the inverter-monitor hardening ADR.
- Device recorded in the asset inventory (site, serial, firmware, who has access).
Code we write
- No secrets in code or repositories. Use environment files kept out of version control, or a secret store. Scan repos with
gitleaksbefore pushing (borrowed from GitLab's "gitleaks on your laptop"). - Review dependencies before adding them, and keep them updated.
- Peer-review changes that touch device control, payments or customer data.
Vulnerabilities
- Anyone who finds a weakness (in our code, a device, a vendor product) reports it like an incident; see Reporting a Security Incident.
- The tech lead sets a severity with the severity matrix and creates a Plane task.
- Target fix times: S1 within 24–72 h, S2 within 2 weeks, S3 within 2 months, S4 best effort. Vendor issues are tracked until the vendor ships a fix, with workarounds (isolation, disabling a feature) in the meantime.